Question 1

Which of the following statements is true about data transformations using SEDCMD?

Options :

A : Can only be used to mask or truncate raw data.

B : Configuredin props.conf and transform.conf.

C : Can be used to manipulate the sourcetype per event.

D : Operates on a REGEX pattern match of the source, sourcetype, or host of an event.

Answer: A

Question 2

Which of the following is a valid stanza in props. conf?

Options :

A : [sourcetype::linux_secure]

B : [host=nyc25]

C : [host::nyc*]

D : [host:nyc*]

Answer: A

Question 3

What is the name of the Splunk Cloud feature that allows you to perform self-service administrative tasks such as creating indexes, inputs, and roles?

Options :

A : Admin Console

B : Admin Dashboard

C : Admin Config Service

D : Admin Toolkit

Answer: C

Question 4

What is the name of the first step that you need to perform to configure the LDAP authentication scheme with Splunk Web?

Options :

A : Configure LDAP settings

B : Create an LDAP strategy

C : Map LDAP groups to Splunk roles

D : Test LDAP connection

Answer: B

Question 5

What is the main advantage of self-service Splunk Cloud over managed Splunk Cloud in terms of cost and control?

Options :

A : Self-service Splunk Cloud costs less to get started and maintain and allows your organization total control in setup and security configurations.

B : Self-service Splunk Cloud costs more to get started and maintain and requires your organization to rely on Splunk for setup and security configurations.

C : Self-service Splunk Cloud costs more to get started and maintain but allows your organization total control in setup and security configurations.

D : Self-service Splunk Cloud costs less to get started and maintain but requires your organization to rely on Splunk for setup and security configurations.

Answer: D